BaFin German Financial Brief

Headline

BaFin issues guidance on ICT risks from AI use in financial institutions, operationalizing DORA expectations for German banks and insurers ahead of EU AI Act high-risk obligations

Executive Summary

The Federal Financial Supervisory Authority (BaFin) has published guidance on the management of ICT risks arising from the use of artificial intelligence in financial institutions, providing the German supervisory interpretation of how Digital Operational Resilience Act (DORA) requirements apply to AI-enabled systems. The guidance, although formally non-binding, signals BaFin's supervisory expectations for German banks, insurers, and investment firms deploying AI for credit underwriting, fraud detection, claims processing, customer interaction, and risk modelling. It establishes a structured framework spanning AI lifecycle governance, data quality controls, model documentation, third-party AI provider oversight, and incident response, anchored to existing DORA obligations.

Key Regulatory Signals

• DORA-AI Translation Layer: The guidance functions as a supervisory bridge between DORA's general ICT risk requirements and the specific characteristics of AI systems, defining how concepts such as ICT third-party providers, ICT incidents, and resilience testing apply where models are trained on third-party data, deployed via cloud APIs, or hosted by external AI vendors. Institutions must read DORA Articles 6, 8, 17, and 28 through this AI-specific lens.
• Model Documentation as Governance Object: BaFin expects board-level governance over AI-enabled systems, with documented model cards covering training data lineage, validation methodology, performance monitoring, drift detection thresholds, and rollback procedures. The expectation tracks the EU AI Act Article 11 documentation standard for high-risk systems and aligns BaFin's supervisory posture with the broader European AI Act enforcement architecture.
• Third-Party AI Provider Concentration Risk: The guidance treats reliance on a small number of large AI cloud providers as a category of ICT third-party concentration risk under DORA Chapter V, requiring institutions to maintain exit strategies, alternative provider assessments, and contractual rights to data portability. This is the first explicit BaFin treatment of foundation-model provider concentration as a supervisory issue.
• Generative AI and Customer Interaction: For chatbot and generative AI customer-facing applications, BaFin signals expectations for explicit AI disclosure to customers, hallucination mitigation controls, audit logging of AI-generated communications, and process boundaries that prevent AI systems from autonomously executing financial transactions without human approval. These standards effectively raise the bar for German consumer-facing AI deployments.
• Bridge to MaRisk and BAIT Frameworks: Although BAIT remains in force until 31 December 2026 alongside DORA, the AI guidance is positioned to be incorporated into BaFin's revised MaRisk framework once BAIT sunsets, providing institutions a forward signal of the consolidated AI/ICT supervisory standard that will apply from 2027.

Regulatory Delta

BaFin's December 2025 guidance is the second AI-specific publication after the 2018 Big Data and AI principles paper, but the first to integrate AI risk management into the post-DORA supervisory architecture. It follows the EU AI Act's entry into force phases (general-purpose model obligations from 2 August 2025, high-risk system obligations from 2 August 2026) and BaFin's 2026 Risks in Focus publication, which identified rapid AI advancement and stablecoin growth as twin systemic concerns. By publishing AI guidance under the existing DORA framework rather than waiting for the AI Act's high-risk obligations to crystallize, BaFin provides German institutions a 6-9 month implementation runway and signals that German supervisory practice will not bifurcate AI oversight between DORA and the AI Act regimes.

Materiality Classification

High — Non-binding guidance carries de facto supervisory authority for German financial institutions, with direct implications for AI governance frameworks, third-party AI vendor relationships, and DORA compliance documentation across credit institutions, insurance undertakings, and investment firms.

Time Horizon

Immediate — Guidance is in effect from publication; institutions deploying AI in production should reassess governance, documentation, and third-party arrangements against the framework now, ahead of EU AI Act high-risk obligations becoming applicable from 2 August 2026.

Intelligence Outlook

Monitor BaFin for follow-up guidance on specific high-impact use cases (credit scoring, claims, anti-fraud) and for the integration of AI provisions into the next MaRisk revision. Track the European Banking Authority for parallel AI guidance under DORA. Assess vendor due diligence packages and AI model documentation against the BaFin framework before the 2 August 2026 AI Act compliance milestone.